ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

ConnectWise has taken precautionary measures by disabling five third-party extensions in partner environments following reports of unauthorized access. The company stated in an advisory that there is no evidence of a compromise of its infrastructure or a vulnerability in the ScreenConnect software itself.

Our initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments, ConnectWise explained. The company has identified about 400 partner environments with at least one of the third-party extensions installed, though it emphasized that the presence of these extensions alone does not indicate compromise.

Attack Methodology

Cybersecurity company Huntress has observed attackers using access to cloud-hosted ScreenConnect panels to push Run commands, installing rogue ScreenConnect clients on at least 288 managed endpoints across 48 organizations. The activity was first detected on November 11, 2026, at around 5:47 p.m. UTC.

The attack unfolds in a worm-like fashion using a two-step process. First, attackers use compromised ScreenConnect panels to deploy rogue clients across endpoints, creating persistent backdoors. Second, when technicians connect to infected endpoints, the malware can spread to their workstations, steal credentials, and pivot to other panels they access.

Malicious Components

SCKit is delivered as an encrypted payload via a Base64-encoded dropper that contacts a remote server to fetch a PowerShell payload. The malware adds Microsoft Defender exclusions, installs attacker-controlled ScreenConnect clients, and creates scheduled tasks.

Notably, signs indicate at least one script was generated by a large language model (LLM) based on detailed source code references and explanatory comments. The infection path works in two stages: from endpoint to technician, and from technician workstation to other endpoints.

Investigation Response

ConnectWise has urged on-premises partners to disable the identified extensions and recommended all partners ensure security controls are active, preserve logs, and monitor for suspicious activities including unusual sign-ins, new administrator accounts, and unexpected remote commands.

The company has shared indicators of compromise including IP addresses, domains, and artifacts. Sophos has also observed similar activity originating from specific compromised ScreenConnect instance IDs, with evidence showing attackers using curl.exe to download and silently install malicious clients.

To add to the concern, the threat actor has been tagging each compromised managed service provider (MSP) with sequential numbers, suggesting other organizations may have been compromised earlier. ScreenConnect users are advised to check their Run Command history even without receiving alerts.